CVE-2026-22786
High · 7.2CVSS
7.2
EPSS
1.1%
Published
Jan 12, 2026
CISA due date
—
The record
Gin-vue-admin is a backstage management system based on vue and gin. Gin-vue-admin <= v2.8.7 has a path traversal vulnerability in the breakpoint resume upload functionality. Attacker can upload any files on any directory. In the breakpoint_continue.go file, the MakeFile function accepts a fileName parameter through the /fileUploadAndDownload/breakpointContinueFinish API endpoint and directly concatenates it with the base directory path (./fileDir/) using os.OpenFile() without any validation for directory traversal sequences (e.g., ../). An attacker with file upload privileges could exploit this vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/flipped-aurora/gin-vue-admin | 0 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260123T022811-150000.1.140.1 |
Related vulnerabilities
- GO-2026-4313 Gin-vue-admin has arbitrary file upload vulnerability caused by path traversal in… Same vulnerability
- CVE-2025-66410 Gin-vue-admin is a backstage management system based on vue and gin. Also affects github.com/flipped-aurora/gin-vue-admin
- CVE-2026-33990 Docker Model Runner (DMR) is software used to manage, run, and deploy AI models using… Also affects govulncheck-vulndb
- CVE-2026-34204 MinIO is a high-performance object storage system. Also affects govulncheck-vulndb
- CVE-2026-34041 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34042 act is a project which allows for local running of github actions. Also affects govulncheck-vulndb
- CVE-2026-34040 Moby is an open source container framework. Also affects govulncheck-vulndb
- CVE-2026-33997 Moby is an open source container framework. Also affects govulncheck-vulndb